Two Distinct Botnets Exploit Wazuh Server Vulnerability to Launch Mirai
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE The Realtek SDK, a software development kit embedded in routers, gateways, and similar network equipment sold under many OEM brands, contains an improper input validation flaw (CWE-20) in its miniigd UPnP SOAP service. A remote, unauthenticated attacker can trigger it by sending a crafted NewInternalClient request to the vulnerable SOAP interface, causing execution of malicious code on the device. Successful exploitation gives attackers control of affected devices, which can be used for botnet recruitment, staging further attacks, or ransomware operations. Affected parties are owners of devices built on the Realtek SDK, particularly routers and gateways with the UPnP service exposed to the internet. Exploitation is ongoing: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-09-18 and EPSS assigns it a 100% probability of exploitation within 30 days, though ransomware use is not confirmed. Do: Inventory devices that use the Realtek SDK and check whether the miniigd UPnP/SOAP service is reachable from untrusted networks; apply firmware updates from your device vendor as soon as available, or per CISA's required action, disable UPnP or block the service from internet exposure if mitigations are unavailable. No patch level is published in this dataset, so verify fix status against OEM advisories and review device logs for crafted NewInternalClient SOAP requests. | — | 100% | KEV |
| mass≈1,000,000+ devices (hundreds of thousands of internet-exposed hosts observed in public scans; SDK embedded in many OEM routers) | |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability. Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code. NVD description · AI analysis pending | 8.8 | 78% |
| — | ||
| CVE-2017-18368 | Unauthenticated OS Command Injection in Zyxel/Billion TrueOnline Routers CVE-2017-18368 is a critical (CVSS 9.8) unauthenticated OS command injection (CWE-78) in the Remote System Log forwarding function of Zyxel P660HN-T1A (v1 and v2) and Billion 5200W-T routers distributed by Thailand ISP TrueOnline. An unauthenticated attacker who can reach the router's web management interface sends a crafted remote_host parameter to the ViewLog.asp page, with no credentials or user interaction required. Successful injection executes arbitrary operating-system commands on the device, giving the attacker full control of the router (e.g., botnet recruitment, traffic/DNS manipulation, or pivoting into the subscriber's LAN). Only TrueOnline-issued units of these models are affected, meaning Thai broadband subscribers deployed with this CPE. The flaw is in CISA's KEV catalog (added 2023-08-07), carries a 94.4% EPSS (100th percentile), and related reporting shows IoT botnets (e.g., Gafgyt campaigns against End-of-Life Zyxel routers and multi-exploit campaigns like RondoDox) actively targeting such devices. Do: Update affected routers to the latest firmware available from Zyxel/Billion or via TrueOnline's ISP update process, noting these models are End-of-Life so hardware replacement is the durable fix. Until patched, restrict or disable WAN-side access to the router's web management interface (the flaw is reachable unauthenticated via ViewLog.asp) and audit devices for signs of botnet compromise. Per the CISA KEV required action, apply vendor mitigations or discontinue use of the product if mitigations are unavailable. | 9.8 | 94% | KEV PoC ×3 |
| mass≈1 million (order-of-magnitude estimate) TrueOnline-issued devices, of which thousands to tens of thousands expose the management interface to the internet at… | |
| CVE-2023-1389 | Command Injection in TP-Link Archer AX21 Router Allows Remote Code Execution CVE-2023-1389 is a command injection flaw (CWE-77) in TP-Link's Archer AX21 Wi-Fi 6 router that lets an attacker execute arbitrary operating-system commands on the device. It is triggered by sending crafted input to a remotely reachable service on the router, which passes attacker-controlled values to the device's shell without proper sanitization; the source data does not specify the vulnerable endpoint or exact affected firmware ranges. Successful exploitation yields remote code execution on the router, giving the attacker a foothold in the network where the router sits, from which they can pivot or abuse the device further. Any household or organization running an Archer AX21 router is affected, with the highest risk where the router's management interface is exposed to the internet. The flaw was added to CISA's KEV catalog on 2023-05-01, confirming exploitation in the wild; EPSS assigns a ~100% probability of exploitation within 30 days (top percentile), while no public proof-of-concept or ransomware association is documented in the source data. Do: Update the Archer AX21 to the latest firmware available from TP-Link per the vendor's instructions (fixed firmware is published on the product's TP-Link support page). If updating is not immediately possible, disable WAN-side/remote management and restrict the router's web interface to the local network. Because exploitation is confirmed in the wild, also review exposed routers for signs of compromise, such as unexplained configuration changes or unexpected outbound traffic. | 8.8 | 100% | KEV PoC ×2 |
| masslikely hundreds of thousands of routers deployed, with >100k plausibly internet-exposed | |
| CVE-2024-3721 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260573 was assigned to this vulnerability. NVD description · AI analysis pending | 6.3 | 86% | — | — | ||
| CVE-2025-24016 | Deserialization RCE in Wazuh Server (CVE-2025-24016) Wazuh Server, the core component of the free and open-source Wazuh threat prevention, detection, and response platform, contains an unsafe deserialization flaw (CWE-502) affecting versions 4.4.0 through all releases prior to 4.9.1. DistributedAPI (DAPI) parameters are serialized as JSON and deserialized by the `as_wazuh_object` function in `framework/wazuh/core/cluster/common.py`; an attacker who injects an unsanitized dictionary into a DAPI request or response can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary Python code, yielding remote code execution on the server. The flaw is rated critical (CVSS 3.1: 9.9) and can be triggered by anyone with API access, such as a compromised dashboard or another Wazuh server in the cluster, and in certain configurations even by a compromised agent. All deployments of Wazuh Server running affected 4.4.x through 4.9.0 versions are affected, particularly those with the API or dashboard exposed to untrusted networks. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-06-10, and Akamai reported that two distinct Mirai botnets are actively targeting unpatched, internet-exposed Wazuh servers. Do: Upgrade Wazuh to version 4.9.1 or later immediately, as required for federal systems under CISA KEV/BOD 22-01 guidance. Until patched, restrict internet exposure of the Wazuh API, dashboard, and cluster communications, and assume compromised agents may be a trigger path in affected configurations. Hunt unpatched servers for signs of compromise, since Mirai botnets are actively scanning for and exploiting this flaw. | 9.9 | 94% | KEV PoC |
| largetens of thousands of internet-exposed Wazuh servers, with total deployments (including internal-only clusters) likely in the hundreds of thousands (estimate) |
Full article1,039 words · extracted from thehackernews.com · click to collapse
A now-patched critical security flaw in the Wazur Server is being exploited by threat actors to drop two different Mirai botnet variants and use them to conduct distributed denial-of-service (DDoS) attacks.
Akamai, which first discovered the exploitation efforts in late March 2025, said the malicious campaign targets CVE-2025-24016 (CVSS score: 9.9), an unsafe deserialization vulnerability that allows for remote code execution on Wazuh servers.
The security defect, which affects all versions of the server software including and above 4.4.0, was addressed in February 2025 with the release of 4.9.1. A proof-of-concept (PoC) exploit was publicly disclosed around the same time the patches were released.
The problem is rooted in the Wazuh API, where parameters in the DistributedAPI are serialized as JSON and deserialized using "as_wazuh_object" in the framework/wazuh/core/cluster/common.py file. A threat actor could weaponize the vulnerability by injecting malicious JSON payloads to execute arbitrary Python code remotely.
The web infrastructure company said it discovered attempts by two different botnets to exploit CVE-2025-24016 merely weeks after public disclosure of the flaw and the release of the PoC. The attacks were registered in early March and May 2025.
"This is the latest example of the ever-shrinking time-to-exploit timelines that botnet operators have adopted for newly published CVEs," security researchers Kyle Lefton and Daniel Messing said in a report shared with The Hacker News.
In the first instance, a successful exploit paves the way for the execution of a shell script that serves as a downloader for the Mirai botnet payload from an external server ("176.65.134[.]62") for different architectures. It's assessed that the malware samples are variants of LZRD Mirai, which has been around since 2023.
It's worth noting that LZRD was also deployed recently in attacks exploiting GeoVision end-of-life (EoL) Internet of Things (IoT) devices. However, Akamai told The Hacker News that there is no evidence that these two activity clusters are the work of the same threat actor given that LZRD is used by myriad botnet operators.
Further infrastructure analysis of "176.65.134[.]62" and its associated domains have led to the discovery of other Mirai botnet versions, including LZRD variants named "neon" and "vision," and an updated version of V3G4.
Some of the other security flaws exploited by the botnet include flaws in Hadoop YARN, TP-Link Archer AX21 (CVE-2023-1389), and a remote code execution bug in ZTE ZXV10 H108L routers.
The second botnet to abuse CVE-2025-24016 employs a similar strategy of using a malicious shell script to deliver another Mirai botnet variant referred to as Resbot (aka Resentual).
"One of the interesting things that we noticed about this botnet was the associated language. It was using a variety of domains to spread the malware that all had Italian nomenclature," the researchers said. "The linguistic naming conventions could indicate a campaign to target devices owned and run by Italian-speaking users in particular."
Besides attempting to spread via FTP over port 21 and conducting telnet scanning, the botnet has been found to leverage a wide range of exploits targeting Huawei HG532 router (CVE-2017-17215), Realtek SDK (CVE-2014-8361), and TrueOnline ZyXEL P660HN-T v1 router (CVE-2017-18368).
"The propagation of Mirai continues relatively unabated, as it remains rather straightforward to repurpose and reuse old source code to set up or create new botnets," the researchers said. "And botnet operators can often find success with simply leveraging newly published exploits."
CVE-2025-24016 is far from the only vulnerability to be abused by Mirai botnet variants. In recent attacks, threat actors have also taken advantage of CVE-2024-3721, a medium-severity command injection vulnerability affecting TBK DVR-4104 and DVR-4216 digital video recording devices, to enlist them into the botnet.
The vulnerability is used to trigger the execution of a shell script that's responsible for downloading the Mirai botnet from a remote server ("42.112.26[.]36") and executing it, but not before checking if it's currently running inside a virtual machine or QEMU.
Russian cybersecurity company Kaspersky said the infections are concentrated around China, India, Egypt, Ukraine, Russia, Turkey, and Brazil, adding it identified over 50,000 exposed DVR devices online.
"Exploiting known security flaws in IoT devices and servers that haven't been patched, along with the widespread use of malware targeting Linux-based systems, leads to a significant number of bots constantly searching the internet for devices to infect," security researcher Anderson Leite said.
The disclosure comes as China, India, Taiwan, Singapore, Japan, Malaysia, Hong Kong, Indonesia, South Korea, and Bangladesh have emerged as the most targeted countries in the APAC region in the first quarter of 2025, according to statistics shared by StormWall.
"API floods and carpet bombing are growing faster than traditional volumetric TCP/UDP attacks, pushing companies to adopt smarter, more flexible defenses," the company said. "At the same time, rising geopolitical tensions are driving a surge in attacks on government systems and Taiwan – highlighting increased activity from hacktivists and state-sponsored threat actors."
It also follows an advisory from the U.S. Federal Bureau of Investigation (FBI) that the BADBOX 2.0 botnet has infected millions of internet-connected devices, most of which are manufactured in China, in order to turn them into residential proxies to facilitate criminal activity.
"Cyber criminals gain unauthorized access to home networks by either configuring the product with malicious software prior to the user's purchase or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process," the FBI said.
"The BADBOX 2.0 botnet consists of millions of infected devices and maintains numerous backdoors to proxy services that cyber criminal actors exploit by either selling or providing free access to compromised home networks to be used for various criminal activity."
Update
Wazuh, in an advisory released on June 11, 2025, said CVE-2025-24016 was fixed in October 2024 with version 4.9.1 and that successfully exploiting it requires an attacker to be in possession of valid administrative API credentials and access to the Wazuh server API.
"As such, the likelihood of exploitation is low, and the overall risk is limited," Wazuh said, adding the flaw has not impacted any of its customers.
(The story was updated after publication to include information shared by Wazuh.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/06/botnet-wazuh-server-vulnerability.html